Overview
overview
10Static
static
10frick-main/bil2.exe
windows10-ltsc_2021-x64
7frick-main/bil3.exe
windows10-ltsc_2021-x64
10frick-main...rw.exe
windows10-ltsc_2021-x64
8frick-main/first.exe
windows10-ltsc_2021-x64
10frick-main...ve.exe
windows10-ltsc_2021-x64
10frick-main...ix.exe
windows10-ltsc_2021-x64
10frick-main...rd.exe
windows10-ltsc_2021-x64
10frick-main...st.exe
windows10-ltsc_2021-x64
10frick-main...ur.exe
windows10-ltsc_2021-x64
10frick-main...wd.exe
windows10-ltsc_2021-x64
10frick-main/second.exe
windows10-ltsc_2021-x64
10Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250410-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
19/04/2025, 06:16
Behavioral task
behavioral1
Sample
frick-main/bil2.exe
Resource
win10ltsc2021-20250410-en
windows10-ltsc_2021-x64
Behavioral task
behavioral2
Sample
frick-main/bil3.exe
Resource
win10ltsc2021-20250410-en
windows10-ltsc_2021-x64
Behavioral task
behavioral3
Sample
frick-main/bilvarw.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral4
Sample
frick-main/first.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral5
Sample
frick-main/kecklowfive.exe
Resource
win10ltsc2021-20250410-en
windows10-ltsc_2021-x64
Behavioral task
behavioral6
Sample
frick-main/keepsix.exe
Resource
win10ltsc2021-20250410-en
windows10-ltsc_2021-x64
Behavioral task
behavioral7
Sample
frick-main/keepthird.exe
Resource
win10ltsc2021-20250410-en
windows10-ltsc_2021-x64
Behavioral task
behavioral8
Sample
frick-main/mineratowerst.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral9
Sample
frick-main/newfour.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral10
Sample
frick-main/nowiwkgtjawd.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
General
-
Target
frick-main/bil2.exe
-
Size
27KB
-
MD5
2ff8e057084b5c180e9b447e08d2d747
-
SHA1
92b35c1b8f72c18dd3e945743cb93e8531d73e2b
-
SHA256
accdada8772018e58baa0ecb3e79c507eb09c7d67f22f59e323c74b51eac9072
-
SHA512
7ae542c6ca36e5ed934ca503f3489144e0ec7d81ad246af88bb525cb494f6725df0aa9131c72afe79ff02364dd65ec7a3ffb01846f99836feff06746193af251
-
SSDEEP
384:9XKCifuPVcppE4KeEdAl7H0I4GSFdr0NAbybMAf3L+9tHmXel7xI:96CiWPVypE4QalMZmoZ3Hmw7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3528707984-280903734-2966936111-1000\Control Panel\International\Geo\Nation bil2.exe Key value queried \REGISTRY\USER\S-1-5-21-3528707984-280903734-2966936111-1000\Control Panel\International\Geo\Nation service.exe -
Executes dropped EXE 1 IoCs
pid Process 1532 service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bil2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3528707984-280903734-2966936111-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3424 schtasks.exe 5476 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5144 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5144 taskmgr.exe Token: SeSystemProfilePrivilege 5144 taskmgr.exe Token: SeCreateGlobalPrivilege 5144 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe 5144 taskmgr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2432 wrote to memory of 5288 2432 bil2.exe 82 PID 2432 wrote to memory of 5288 2432 bil2.exe 82 PID 2432 wrote to memory of 5288 2432 bil2.exe 82 PID 5288 wrote to memory of 3424 5288 cmd.exe 84 PID 5288 wrote to memory of 3424 5288 cmd.exe 84 PID 5288 wrote to memory of 3424 5288 cmd.exe 84 PID 1532 wrote to memory of 2336 1532 service.exe 98 PID 1532 wrote to memory of 2336 1532 service.exe 98 PID 1532 wrote to memory of 2336 1532 service.exe 98 PID 2336 wrote to memory of 5476 2336 cmd.exe 100 PID 2336 wrote to memory of 5476 2336 cmd.exe 100 PID 2336 wrote to memory of 5476 2336 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\frick-main\bil2.exe"C:\Users\Admin\AppData\Local\Temp\frick-main\bil2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /tn GoogleUpdaterex /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn GoogleUpdaterex /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3424
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5144
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1100
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /tn GoogleUpdaterex /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn GoogleUpdaterex /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5476
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD52ff8e057084b5c180e9b447e08d2d747
SHA192b35c1b8f72c18dd3e945743cb93e8531d73e2b
SHA256accdada8772018e58baa0ecb3e79c507eb09c7d67f22f59e323c74b51eac9072
SHA5127ae542c6ca36e5ed934ca503f3489144e0ec7d81ad246af88bb525cb494f6725df0aa9131c72afe79ff02364dd65ec7a3ffb01846f99836feff06746193af251